From dump to phishing kit: inside the breach data resale pipeline
When a company confirms a breach, headlines fixate on how many records were taken. The more consequential question is what happens next, because stolen data almost never travels directly from the server that lost it to the criminal who finally uses it. It moves down a resale pipeline with its own specialists: brokers who take the first copies, aggregators who merge dumps, enrichers who add value to raw rows, resellers who repackage the same material under new names, and finally the operators of phishing kits and automated login tools who consume the finished product.
The first sale
A freshly stolen database is worth most in its first days. On cybercrime forums a seller can run a private sale to one or a few buyers who pay for exclusivity, or open a public thread and sell copies one by one. The venue matters less than newcomers assume. A Flashpoint timeline of breach-data trading shows the pattern: Raid Forums fell after its founder's arrest in January 2022, Breach Forums rose in its place, its administrator was arrested in March 2023, and a queue of successors, including Exposed, PwnedForums and a ShinyHunters-backed relaunch, fought over the same trade, at one point leaking a database of 478,870 Raid Forums user records in the process. Takedowns disrupt distribution, not inventory. The data itself survives each collapse and migrates to the next platform, which is why a seizure announcement rarely means the material is gone. It has usually been copied many times over before the lights go out.Aggregation, then enrichment
Raw dumps are unwieldy: inconsistent formats, duplicates, password hashes of varying strength. Aggregators normalize the material into email-and-password pairs, and SpyCloud notes that combolists typically combine data from multiple corporate breaches. Enrichment is where the margin gets added. A reseller can test pairs against live logins to see which still work, map one person's accounts across services by matching addresses, append phone numbers or physical addresses from unrelated leaks, and pair records with infostealer logs that carry cookies and session tokens. Each step turns a raw row into something a buyer can act on directly. Pricing reflects that processing. Securelist's analysis of roughly two hundred dark web forum posts found stealer logs traded in bulk, with one seller offering two terabytes of 2020 to 2021 material, while a buyer in the same study offered fifty cents per valid account where a payment card was attached, with a minimum order of 150 lines. Unsorted data is cheap; validated data is priced per hit."Criminals often attempt credential stuffing attacks years after their initial combolists were downloaded. They know users frequently forget to reset passwords." - SpyCloud Labs
Retagging and repackaging
The same rows can be sold far more than once. An old dump reappears inside a collection labelled as fresh, files get renamed, split by country or industry, cracked into plaintext or folded into subscription-style update feeds. Buyers rarely see provenance, and the label mostly means new to this seller. Repackaging works because the underlying weakness persists: SpyCloud measured a 70 percent password reuse rate among users exposed in breaches during 2021, and 64 percent among Fortune 1000 employees, so pairs from years-old incidents keep opening current accounts.The price decay curve
Stolen data behaves like a perishable commodity. Prices start high while a leak is exclusive and fall as copies spread and the working share of the data shrinks: victims reset passwords, sites force rotation, payment cards get cancelled. Securelist found most corporate access offers priced below 5,000 dollars, with access to large companies typically at 2,000 to 4,000, while bulk consumer credentials change hands for cents per line. What keeps old data commercially alive is volume plus reuse. Even a small validity rate across a very large list feeds automated tools for years, so nothing in the pipeline is ever thrown away.Where the chain can be broken
Every stage of the pipeline has a defender counterpart, and the cheapest interventions sit at the point of use rather than at the source:- Validate and reset: check logins against exposure databases and force a reset when a password appears in known dumps, so old combolists die at the door instead of waiting for a takedown that only shifts the venue.
- Second factors and passkeys: these blunt the end products of the pipeline, whether the input was a fresh log or a decade-old dump, because a reused password alone stops being sufficient.
- Date the data, not the listing: much breach chatter repackages years-old incidents, so treat fresh labels with suspicion and verify dates before reacting to a leak.
- Watch the broker layer: monitoring for your organisation's domains and employee addresses in aggregated databases gives early warning that material is circulating downstream.